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Decoded property 
values 
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I-TLB 
property bi 


l\ 

< 

S2 


■o 


Protected | 


Interpretation 

1 


Instructions ser 


Collect profi 
trace-packet 


Probe for 
translated co 


I/O memor) 
reference 
exceptions 


00 


Tap 


Tap 


no 


Native code observing native 
RISCy calling conventions 


Native 
decoder 


No 


No 


Fault 
if SEG.tio 


01 


Tap 


x86 


no 


Native code observing x86 
calling conventions 


Native 
decoder 


No 


No 


Fault 
if SEG.tio 


10 


x86 


x86 


no 


x86 code, unprotected - 
TAX! profile collection only 


x86HW 
converter 


If enabled 


No 


Trap 
if profiling 


11 


x86 


x86 « 


yes 


x86 code, protected - 
TAX! code may be available 


x86HW 
converter 


If enabled 


Based on I- 
TLB probe 
attributes 


Trap 
if profiling 



y an - 



2.2- «K 
ZZ&w 



; Significance of the I-TLB property bits 



ISA & CC transition exception flow 



A 





name 


description 


type 




VECT_caIl_X86_CC 


push args, return address, set up x86 state 


fault on target instruction 




VECTJump_X86_CC 


set up x86 state 


fault on target instruction 




. VECT_reuno_fp_X86_CC 


return value to eax:edx, set up x86 state 


fault on target instruction 




VECT_ret_fp_X86_CC 


return value to x86 fp stack, set up x86 state 


fault on target instruction 




VECT_call_TAP_CC 


x86 stack args, return address to registers 


fault on target instruction 




VECTJump_TAP_CC 


x86 stack args to registers 


fault on target instruction 




VECT_ret_no_fp_TAP_CC 


return value to RV0 


fault on target instruction 


ZS£>2- 


VECT_ret_any_TAP_CC 


return type unknown, setup RV0 and RVDP 


fault on target instruction 



(T^ CC transition exceptions 



Transition ( source => dest ) 
ISA & CC property values 


Handler Action 


00 =>00 


No transition exception 


00 =>01 


VECT_xxx_X86_CC exception - handler converts from native to x86 conventions 


00 =>lx 


VECT_xxx_X86_CC exception - handler converts from native to x86 conventions, 

sets up expected emulator and profiling state 


01 =>00 


VECT_xxx_TAP__CC exception - handler converts from x86 to native conventions 


01 =>01 


No transition exception 


01 => lx 


VECT_X86_ISA exception [conditional based on PCW.X86_ISAJENABLE flag] 
- sets up expected emulator and profiling state 


lx=>00 


VECT_xxx_TAP_CC exception - handler converts from x86 to native conventions 


lx=>01 


VECT_TAP_ISA exception [conditional based PCW.TAP_ISA_ENABLE flag] 
- no convention conversion necessary 


lx=> 10 


No transition exception - [profile complete possible, probe possible] 


lx => 11 


No transition exception - [profile complete possible, probe NOT possible] 
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CALL- > 



Flat 32-bit "Near" Address Space 



Transparency: 

. x86 code adheres to traditional 

x86 stack-based conventions 
. RISC uses higher performance 

register-based conventions 
. Caller has no knowledge 

of callee's ISA 
. Callee has no knowledge 

of ISA to which it will return 




I — Flat 32-bit "Near" Address Space — . 
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Flat 32-bit "Near" Address Space 




j|l SC -> x86 transition: 
map RISC calltox86 



x86-> RISC transition: 
map RISC return to x86 



no ISA transition: 
no mapping required 
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Flat 32-bit "Near" Address Space 
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Flat 32-bit "Near" Address Space 




I 



=BISC x86 transition: 
map x86 return to RISC 



x86-> RISC transition: 
map x86 call to RISC 

Bzz (F«^. 3»0 



no ISA transition: 
no mapping required 
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+ 



- + 

I 

V 



+ 



3ji9 

x86 preamble: 
(need not be inline) 

-Load register args 

-Fill-in return trans- 
fer argument area 

+ + + 



GENERAL_ENTRY : 

YES | 

+ 



XD == 0? 



NO 



NATIVE ENTRY: V 

3*8 

native preamble: 
(typically vacuous) 

-Varargs 

-AP for a very big 
argument list 



omit if 
NATIVE ONLY 



+ v - 

| FUNCTION 


BODY 


+ 


| set up XD: 
j XD <- 


K 


| omit if 
j NAT I VE_ONLY 


| RET 
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X86-to-Tapestry transition exception handler f *~ 

II This handler is entered under the following conditions: 
// 1 . An x86 caller invokes a native function 
111. An x86 function returns to a native caller 

// 3. x86 software returns to or resumes an interrupted native function following 
// an external asynchronous interrupt, a processor exception, or a context switch 

dispatch on the two least-significant bits of the destination address { 

case "00" // calling a native subprogram 

// copy linkage and stack frame information and call parameters from the memory 
// stack to the analogous Tapestry registers 
LR <- [SP++] // set up linkage register ~ 32-3 
AP <- SP // address of first argument 3Z*1 

SP <- SP - 8 // allocate return transfer argument area 32.^ 

SP <- SP & (-32) // round the stack pointer down to a 0 mode 32 boundary — TZ7 
XD <- 0 // inform callee that caller uses X86 calling conventions ~~ 328 

'gase "01" // resuming an X86 thread suspended during execution of a native routine 



if the redundant copies of the save slot number in EAX and EDX do not match or if "7 ^ 
the redundant copies of the timestamp in EBX:ECX and ESLEDI do not match { J 
// some form of bug or thread corruption has been detected 
goto TAPESTRY_CRASH_SYSTEM( thread-corruption-error-code ) 2>7 

} 

save the EBX:ECX timestamp in a 64-bit exception handler temporary register ? 

(this will not be overwritten during restoration of the foil native context) 3 
use save slot number in EAX to locate actual save slot storage — 37 ^ 
restore foil entire native context (includes new values for all x86 registers) - — 373 
if save slot's timestamp does not match the saved timestamp { 37 C» 

// save slot as been reallocated; save slot exhaustion has been detected 
goto TAPESTRY_CRASH_SYSTEM( save-slot-overwritten-error-code ) ~ 3"?7 

} 

free the save slot *" x - 3"7f$ 



case "10" // returning from X86 callee to native caller, result already in registers 

RV0<63 :32> <- edx<3 1 :00> // in case result is 64 bits ~~ 33 3 

convert the FP top-of-stack value from 80 bit X86 form to 64-bit form in RVDP-* 33«r 
SP«-ESI // restore SP from time of call -^33? 

case "11" // returning from X86 callee to native caller, load large result from memory " 

RV0..RV3 <- load 32 bytes from [ESI-32] // (guaranteed naturally aligned) -^33o 
SP<-ESI // restore SP from time of call —"537 

} 

EPC <r- EPC & -4 // reset the two low-order bits to zero <~* "£"3-fc» 
RFE -v- 33© 
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406036J 



Tapestry-to-X86 transition exception handler 

// This handler is entered under the following conditions: 
// 1. a native caller invokes an x86 function 
// 2. a native function returns to an x86 caller 
switch on XD<3:0> { 3^1. 

XD_RET_FP : // result type is floating point 

F0/F1 <- FINFLATE.de( RVDP ) // X86 FP results are 80 bits 
SP <- from RXA save // discard RXA, pad, args 

FPCW <r- image after FINIT & push // FP stack has 1 entry 
goto EXIT 



XD RET WRITEBACK: // store result to @RVA, leave RVA in eax 

RVA <- from RXA save // address of result area 
copy decode(XD<8:4>) bytes from RV0..RV3 to [RVA] 

eax <- RVA // X86 expects RVA in eax 

O SP <— from RXA save // discard RXA, pad, args 

S FPCW <- image after FINIT // FP stack is empty 

*ui goto EXIT 



iXD RET SCALAR: 



// result in eax:eda 



edx<31:00> <- eax<63:32> 
SP <- from RXA save 
FPCW <- image after FINIT 
goto EXIT 



// in case result is 64 bits 
// discard RXA, pad, args 
// FP stack is empty 



j^dj:all_hidden_temp: 

% esi<-SP 

S SP <-SP-32 
RVA <r- SP 
LR<1:0><-"11" 
goto CALLCOMMON 



3«« 



// allocate 32 byte aligned hidden temp 
// stack cut back on return ^ 
// allocate max size temp "2 3^4 

// RVA consumed later by RR 3 
// flag address for return & reload 3*V5 



// remaining XDCALLxxx encodings 
// stack cut back on return 
// flag address for return "S»*\(» 



default: 

esi <- SP 
LR<1:0><-"10" 
CALL_COMMON: 

interpret XD to push and/or reposition args "^47 
[-SP] <- LR // push LR as return address 

EXIT: 

setup emulator context and profiling ring buffer pointer 

} 

RFE ~ 3>*V9 

} 



} 



3H© 



// to original target 
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^S5D 

interrupt/exception handler of Tapestry operating system: ^ 

II Control vectors here when a synchronous exception or asynchronous interrupt is to be 
// exported to / manifested in an x86 machine. 



// The interrupt is directed to something within the virtual X86, and thus there is a possibility 
// that the X86 operating system will context switch. So we need to distinguish two cases: 
// either the running process has only X86 state that is relevant to save, or 
// there is extended state that must be saved and associated with the current machine context 
// (e.g., extended state in a Tapestry library call in behalf of a process managed by X86 OS) 
if execution was interrupted in the converter - EPC.ISA = X86 { ~> 

// no dependence on extended/native state possible hence no need to save any r "3** 
goto EM86_Deliver_Interrupt( interrupt-byte ) J 
} else if EPC.Taxi Active { 

// A Taxi translated version of some X86 code was running. Taxi will rollback to an 
// x86 instruction boundary. Then, if the rollback was induced by an asynchronous external 
// interrupt Taxi will deliver the appropriate x86 interrupt. Else, the rollback was induced 
n II by a synchronous event so Taxi will resume execution in the converter, retriggering the 
\q II exception but this time will EPC.ISA = X86 
m goto TAXi_Rollback( asynchronous-flag, interrupt-byte ) 
} elsejf EPC.EM86 { ~ 
\Q II The emulator has been interrupted. In theory the emulator is coded to allow for such 
1=^ // conditions and permits re-entry during long running routines (e.g. far call through a gate) 
*0 // to deliver external interrupts 
s r goto EM86 JDeliver_Interrupt( interrupt-byte ) 



i 



r; II This is the most difficult case - the machine was executing native Tapestry code on 
^ 3 // behalf of an X86 thread. The X86 operating system may context switch. We must save 
!*% // all native state and be able to locate it again when the x86 thread is resumed. 

:Q allocate a free save slot; if unavailable free the save slot with oldest timestamp and try again 
save the entire native state (both the X86 and the extended state) "7 ^ 
save the X86 EIP in the save slot 3 
overwrite the two low-order bits of EPC with "01" (will become X86 interrupt EIP) 3^3 
store the 64-bit timestamp in the save slot, in the X86 EBX:ECX register pair (and, ? 

for further security, store a redundant copy in the X86 ESLEDI register pair) 6 
store the a number of the allocated save slot in the X86 EAX register (and, again for 7 3^5 

further security, store a redundant copy in the X86 EDX register) *\ 
goto EM86_Deliver_Interrupt( interrupt-byte ) _ 
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typedef struct { 
saveslott * 
save_slot_t * 
unsigned int64 
unsigned int64 
unsigned int64 

timestampt 
int 

boolean 
} save_slot_t; 



newer; 
older; 
epc; 
pew; 

registers[63]; 



// pointer to next-most-recently-allocated save slot 7 370^ 
// pointer to next-older save slot _5 
// saved exception PC/IP 

// saved exception PCW (program control word) L 3S6» 
// save the 63 writeable general registers 
// other words of Tapestry context 



timestamp; // timestamp to detect buffer overrun 
save_slot_ID; // ID number of the save slot ~ 3^7 
save_slot_is_full; // full / empty flag 3S9 



save_slot_t * save_slot_head; // pointer to the head of the queue 37^ a. 

save slot t * save slot tail; // pointer to the tail of the queue "2>"7S> b 

system initialization 

^dbserve several pages of unpaged memory for save slots 



Fig. 3k 
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Flat 32-bit "Near" Address Space 
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Flat 32-bit "Near" Address Space 




Initiate x86 excep. or int. -| 

. Alloc free or oldest save slo 
. Store timestamp & full state 
. x86 regs<- save slot ID, TS 
. EPC<1:0><- 01 



1% ! 




• 
• 




2> 



Handler: x86 



EPC<1:0> = 01: 



x86 regs points to save slot 
Using TS verify no overwrite 
Restore full state 
Free save slot 
EPC<1:0><- 00 23?\\- 
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Flat 32-bit "Near" Address Space 
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7 entry trace packet 



Entry 


Event Code 


Done Addr 


Next Addr 




64 bit time stamo 


1 


ret 


x86 context 


physX:f 


2 


new page 


phys Y:z 


physYih 


3 


jcc forward 


phvs Y:i 


phvs Y:k 


4 


jnz backward 


phys Y: I 


phys X: a 


5 


seq; env channe 


x86 context 


physXib 


6 


ip-rel near call 


physXic 


phys Z:d 


7 


near ret 


phys Z:e 


physXf 



-4S° 
• 430 



Source 1 


Code 


Event 


Reuse event code 


Profileable event 


Initiate packet 


Probeable event 


Probe event bit - 
ITLB probe attribute 
or 

Emulator probe 




0.0000 


Default (x86 transparent) event, reuse all converter values 


yes 












0.0001 


Simple x86 instruction completion (reuse event code) 


yes 




Y\o 








0.0010 


Probe exception failed 


yes 




V\p 






0.0011 


Probe exception failed, reload probe timer 


yes 




V\0 








0.0100 




no 


no 


no 


no 


- 


s 


0.0101 


Sequential; execution environment changed — -f o roe- eve**^ 


no 


yes 


no 


no 


- 


(5 

"3 


0.0110 


Far RET 


no 


yes 


yes 


no 


- 




0.0111 


IRET 


no 


yes 


no 


no 


- 


i 


0.1000 


Far CALL 


no 


yes 


yes 


yes 


Far call 


l 


0.1001 


Far JMP 


no 


yes 


yes 


no 


- 




0.1010 


Special; emulator execution, supply extra instruction data a 


no 


yes 


no 


no 


- 


1 


0.1011 


Abort profile collection 


no 


no 


no 


no 


- 




0.1100 


x86 synchronous/asynchronous interrupt w/probe (GRP 0) 


no 


yes 


yes 


yes 


Emulator probe 




0.1101 


x86 synchronous/asynchronous interrupt (GRP 0) 


no 


yes 


yes 


no 


- 




0.1110 


x86 synchronous/asynchronous interrupt w/probe (GRP 1) 


no 


yes 


yes 


yes 


Emulator probe 




0.1111 


x86 synchronous/asynchronous interrupt (GRP 1) 


no 


yes 


yes 


no 






1.0000 


IP-relative JNZ forward (opcode: 75, OF 85) 


no 


yes 


yes 


no 


- 




1.0001 


IP-relative JNZ backward (opcode: 75, OF 85) 


no 


yes 


yes 


yes 


Jnz 




1.0010 


IP-relative conditional jump forward - (Jcc, Jcxz, loop) 


no 


yes 


yes 


no 






L0011 


IP-relative conditional jump backward - (Jcc, Jcxz, loop) 


no 


yes 


yes 


yes 


Cond jump 


I 


1.0100 


IP-relative, near JMP forward (opcode: E9, EB) 


no 


yes 


yes 


no 






1.0101 


IP-relative, near JMP backward (opcode: E9, EB) 


no 


yes 


yes 


yes 


Near jump 




1.0110 


RETT/ RET imml6 (opcode C3, C2 /w) 


no 


yes 


yes 


no 






1.0111 


IP-relative, near CALL (opcode: E8) 


no 


yes 


yes 


yes . 


Near call 




1.1000 


REPE/REPNE CMPS/SCAS (opcode: A6, A7, AE, AF) 


no 


yes 


no 


no 






1.1001 


REP MOVS/STOS/LDOS foDCode* A4 A5 AA AB AC AD) 


no 


yes 


no 


no 




u 


1.1010 


Indirect near JMP (opcode: FF/4) 


no 


yes 


yes 


no 




o 

u 


1.1011 


Indirect near CALL (opcode: FF 12) 


no 


yes 


yes 


yes 


Near call 




i i inn 


loau Hum u\j memory ^ 1 ld.cisi i— uj \ fioi usca in 1 1 ) 


no 


yes 


no 


no 






1.1101 




|™> 


V\o 


no 


no 






1.1110 


Default converter event; sequential 4g£> 


no 


no 


no 


no 






1.1111 


New page (instruction ends on last byte of a page frame or 
straddles across a page frame boundary) ^0€> 


no 


yes 


no 


no 





a. Used by emulator for new x86 opcodes. Extra information supplied in TaxijControLspecialjopcode bits. 
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